WO2020021714A1

WO2020021714A1 - Fraud prevention method and secure star coupler

Info

Publication number: WO2020021714A1
Application number: PCT/JP2018/028294
Authority: WO
Inventors: 剛岸川; 良浩氏家; 平野　亮
Original assignee: パナソニックインテレクチュアルプロパティコーポレーションオブアメリカ
Priority date: 2018-07-27
Filing date: 2018-07-27
Publication date: 2020-01-30
Also published as: CN111788800B; EP3832956A1; JPWO2020022445A1; EP3832956A4; JP7337063B2; EP3832956B1; US11764998B2; CN111788800A; WO2020022445A1; US20210051090A1

Abstract

In an on-vehicle network of the present invention, a plurality of branches configured by one or more electronic control devices and one on-vehicle network bus are connected via a secure star coupler (300). The electronic control devices each transmit and receive a frame within a prescribed time slot. The secure star coupler (300) is provided with: transceiver units (301a-301d) the number of which is equal to the number of the branches; a routing unit (302); and a holding unit (305). Each of the transceiver units (301a-301d) is connected to any one of the branches, and is provided with: a reception unit that converts a physical signal of the bus of the branch to a digital signal, and notifies the routing unit (302) of the digital signal; and a transmission unit that converts the digital signal to a physical signal, and transmits the physical signal to the bus. Unless a non-transfer condition is satisfied, the routing unit (302) transfers a digital signal from a first transceiver unit connected to a first branch, to a transceiver unit other than the first transceiver unit.

Description

Fraud prevention method and secure star coupler

The present disclosure relates to a secure star coupler that prevents transmission of an illegal frame in a star topology vehicle-mounted network.

In recent years, a number of devices called electronic control units (hereinafter referred to as ECUs) are arranged in systems in automobiles. A network connecting these ECUs is called an in-vehicle network. There are many standards for in-vehicle networks. Among them, there is a standard called FlexRay, which is designed as a protocol that is faster and more reliable than the currently mainstream Controller @ Area @ Network (hereinafter, CAN).

FlexRay represents a value of “0” and a value of “1” by a voltage difference between two stranded wires. The ECU connected to the bus is called a node. Each node connected to the bus sends and receives messages called frames. FlexRay is a Time \ Division \ Multiple \ Access (TDMA) system, and each node transmits a frame at a predetermined timing.

In @FlexRay, there is a cycle that is the maximum time unit, and each node synchronizes the global time. A cycle is composed of four segments: a "static segment", a "dynamic segment", a "symbol window", and a "network idle time". The dynamic segment and the symbol window are optional. Each node sends frames in static and dynamic segments. The static segment and the dynamic segment are further composed of time during which one frame called a slot can be transmitted.

In FlexRay, there is no identifier indicating the transmission destination or the transmission source, and the transmission node transmits a frame based on a slot number that is a transmission timing predetermined for each frame. Each receiving node receives only a frame with a predetermined slot number. In addition, a method called “cycle multiplexing” that realizes communication of different frames depending on the cycle even if the frames have the same slot number is used.

In addition, in FlexRay, not only a bus-type network topology in which all nodes are connected to a single bus like a CAN, but also a star-type network topology via a star coupler or a hybrid type of bus-type and star-type networks It is possible to design a topology.

On the other hand, regarding security, there is a threat that an attacker accesses the CAN bus and transmits an illegal frame to illegally control the ECU, and security measures are being studied.

For example, Patent Literature 1 proposes an in-vehicle network monitoring device that detects whether a frame is transmitted to a CAN at a predetermined communication interval, and determines that a frame deviating from the specified communication interval is invalid. Discloses a method for preventing control by an illegal frame.

Japanese Patent No. 5664799 Japanese Patent No. 4871395

However, in FlexRay employing a time-triggered communication method, communication is performed at a predetermined communication interval, so that a reception interval of a frame having a specific identifier is always constant. No detection method can be applied. In FlexRay, a star network topology is often used from the viewpoint of design easiness. On the other hand, Patent Literature 2 discloses an intelligent star coupler that switches a transfer source branch according to a time schedule. The intelligent star coupler makes it possible to prevent the injection of an attack frame from a branch that is not originally supposed to transmit a frame, but it is impossible to know that an attack has been attempted. Further, with the intelligent star coupler disclosed in Patent Document 2, if an illegal node exists in a branch scheduled to be transmitted, injection of an illegal frame cannot be prevented.

The present disclosure solves the above-described problems, in a vehicle-mounted network adopting a protocol that is a time-triggered communication method, when a network is designed according to a star topology, an illegal frame transmission location is grasped and addressed. To provide a secure in-vehicle network system.

An injustice detection prevention device according to an aspect of the present disclosure is a secure star coupler in an in-vehicle network that is a time-triggered communication method based on a time slot, wherein the in-vehicle network includes one or more electronic control devices and one A plurality of branches including an in-vehicle network bus are connected through a secure star coupler, the electronic control unit transmits and receives frames within a predetermined time slot, and the secure star coupler includes a plurality of transceiver units corresponding to the number of branches. , A routing unit, and a routing rule holding unit, wherein the transceiver unit is connected to one of the branches, converts a physical signal of a bus of the connected branch into a digital signal, and From the receiving unit that notifies And a transmitting unit for converting the received digital signal into a physical signal and transmitting the converted signal to the bus, wherein the routing unit is connected to the first branch unless the non-transfer condition is met. The digital signal received from the transceiver unit is transferred to a plurality of transceiver units other than the first transceiver unit, and the non-transfer condition does not match a predetermined condition described in the routing rule holding unit; Receiving a digital signal from a second transceiver unit other than the first transceiver unit already connected to the first branch, and transferring the digital signal to a transceiver unit other than the second transceiver unit; The routing rule holding unit holds a rule indicating a correspondence between a time slot and an identifier of a branch or transceiver unit to be received. It is a cure star coupler.

Note that these general or specific aspects may be realized by a recording medium such as an apparatus, a system, an integrated circuit, a computer program, or a computer-readable CD-ROM. It may be realized by an arbitrary combination of recording media.

According to the present disclosure, a time-triggered communication method is adopted, and even for an in-vehicle network designed in a star topology, by grasping a transmission position of an invalid frame, it is This makes it possible to cope with the situation, and to maintain a safe state as the whole in-vehicle network system.

FIG. 1 is an overall configuration diagram of a vehicle-mounted network system 10 according to the first and second embodiments. FIG. 2 is a diagram illustrating a FlexRay cycle according to the first and second embodiments. FIG. 3 is a diagram showing a format of a FlexRay frame according to the first and second embodiments. FIG. 4 is a configuration diagram of the ECU 200a according to the first and second embodiments. FIG. 5 is a configuration diagram of the secure star coupler 300 according to the first embodiment. FIG. 6 is a configuration diagram of the fraud detection ECU 310 according to the first embodiment. FIG. 7 is a diagram illustrating an example of communication setting parameters stored in the communication setting parameter holding unit 205 according to the first and second embodiments. FIG. 8 is a diagram illustrating an example of the received frame information stored in the received frame holding unit 304 according to the first and second embodiments. FIG. 9 is a diagram illustrating an example of a routing table stored in the routing table holding unit 305 according to the first and second embodiments. FIG. 10 is a diagram illustrating an example of frame information stored in the frame information holding unit 314 according to the first and second embodiments. FIG. 11 is a diagram illustrating an example of a frame rule stored in the frame rule holding unit 315 according to the first and second embodiments. FIG. 12 is a diagram illustrating an example of a branch abnormality degree stored in the branch abnormality degree holding unit 316 according to the first and second embodiments. FIG. 13 is a diagram illustrating an example of a reception history stored in the reception history holding unit 317 according to the first and second embodiments. FIG. 14 is a processing flowchart of the secure star coupler 300 according to the first embodiment. FIG. 15 is a processing flowchart of the fraud detection ECU 310 in the first embodiment. FIG. 16 is a configuration diagram of a secure star coupler 1300 according to the second embodiment. FIG. 17 is a configuration diagram of a fraud detection ECU 1310 according to the second embodiment. FIG. 18 is a diagram illustrating an example of a blacklist stored in the blacklist holding unit 1306 according to the second embodiment. FIG. 19 is a diagram illustrating an example of a traveling state stored in the traveling state holding unit 1307 according to the second embodiment. FIG. 20 is a processing flowchart when the secure star coupler 1300 according to the second embodiment receives a frame. FIG. 21 is a processing flowchart of the fraud detection ECU 1310 according to the second embodiment.

An anti-fraud device according to an embodiment of the present disclosure is a secure star coupler in a vehicle-mounted network that is a time-triggered communication system based on a time slot, wherein the vehicle-mounted network includes one or more electronic control devices and one vehicle-mounted device. A plurality of branches composed of a network bus are connected through a secure star coupler, the electronic control unit transmits and receives frames within a predetermined time slot, and the secure star coupler includes a plurality of transceiver units corresponding to the number of branches. , A routing unit, and a routing rule holding unit, wherein the transceiver unit is connected to one of the branches, converts a physical signal of a bus of the connected branch into a digital signal, and sends the digital signal to the routing unit. A receiving unit for notifying and receiving from the routing unit A transmission unit for converting the digital signal into a physical signal and transmitting the physical signal to the bus, wherein the routing unit is connected to the first branch unless the non-transfer condition is met. Transferring the digital signal received from the unit to a plurality of transceiver units other than the first transceiver unit, wherein the non-transfer condition does not match a predetermined condition described in the routing rule holding unit; Receiving the digital signal from a second transceiver unit other than the first transceiver unit connected to the first branch, and transferring the digital signal to a transceiver unit other than the second transceiver unit; The rule holding unit stores a rule indicating a correspondence between a time slot and an identifier of a branch or transceiver unit to be received. It is a Astor coupler. As a result, even if an illegal frame is transmitted on a branch that does not match the routing rule, the transfer of the illegal frame is prevented by the secure star coupler, and the security of the vehicle-mounted network is improved.

Further, the secure star coupler further includes a branch abnormality degree holding unit, the branch abnormality degree holding unit holds an abnormality degree for each branch, the abnormality degree is held in the routing rule holding unit, When a digital signal is received from the third transceiver unit at a timing that does not match the rule, the degree of abnormality of the branch corresponding to the third transceiver unit is increased, and the non-transfer condition additionally includes the reception of the digital signal. It may be a case where the corresponding abnormality degree held in the branch abnormality degree corresponding to the transceiver unit described above is equal to or greater than a predetermined value. Thereby, it may be possible to prevent the transfer of the frame transmitted from the branch determined that the transmission of the illegal frame is continued.

Further, the secure star coupler further includes an error detection unit that decodes a digital signal of each branch and detects whether or not an error has occurred in a protocol in a frame for each branch. When the first error detection unit detects an error in a time slot in which the rule is valid, which is described in the rule holding unit, the degree of abnormality of the branch corresponding to the first error detection unit may be increased. . As a result, it is possible to perform the transfer according to the routing rule and to grasp the branch in which the transmission of the illegal frame is being attempted while maintaining the security of the vehicle-mounted network.

The secure star coupler further includes a communication control unit for performing communication with an electronic control unit, and the routing unit further decodes a digital signal received from the first transceiver unit and interprets the digital signal as a frame. A receiving frame holding unit for holding together a decoder unit, the frame, and an identifier indicating the first transceiver unit that is a transfer source, wherein the communication control unit includes information of the receiving frame holding unit. May be notified to the electronic control unit. As a result, the source branch of the received frame can be easily grasped by the external device, and the cause of the fraud can be easily specified.

In addition, the secure star coupler further includes a blacklist holding unit that holds a blacklist, and the blacklist holding unit holds a condition of a value of a payload included in a frame in a predetermined time slot, which prohibits transfer. The routing unit further includes a blacklist matching unit that decodes the digital signal being transferred and is included in the blacklist holding unit and performs matching with a corresponding rule. If the digital signal is determined to match the blacklist, the transfer of the subsequent digital signal may be stopped. As a result, even if the frame is an illegal frame that matches the routing rule, it is possible to detect the illegal frame from the payload included in the frame and prevent the transfer.

Further, the secure star coupler further includes a traveling state holding unit, and the communication control unit further receives a traveling state from an electronic control device and updates a value of the traveling state holding unit. The blacklist collating unit may stop the subsequent transmission of the signal being transmitted that matches the blacklist only when the traveling state of the traveling state holding unit satisfies a predetermined condition. . In this way, by switching whether or not to prohibit the transfer of unauthorized frames according to the running state of the vehicle, it is possible to prevent the transmission of unauthorized frames in situations that are dangerous for the driver, and to intervene in the in-vehicle network system in safe situations. Can be avoided.

Further, a fraud prevention method according to an embodiment of the present disclosure is a fraud prevention method in a vehicle-mounted network that is a time-triggered communication system based on a time slot, wherein the vehicle-mounted network includes one or more electronic control devices and one or more electronic control devices. A plurality of branches composed of one vehicle-mounted network bus are connected through a secure star coupler, the electronic control unit transmits and receives frames within a predetermined time slot, and the fraud prevention method includes a plurality of transmission and reception corresponding to the number of branches. A transmitting / receiving step of converting a physical signal of a bus of any branch into a digital signal and notifying the digital signal to the routing step; Digital signal received from step Transmitting the signal to the bus, and transmitting the signal to the bus, wherein the routing step receives from the first transmission / reception step that handles the physical signal of the first branch unless the non-transfer condition is met. The digital signal is transferred to a plurality of transmission / reception steps other than the first transmission / reception step, and the non-transfer condition does not match the predetermined condition described in the routing rule holding step, and the first branch already exists. A digital signal is received from a second transmission / reception step other than the first transmission / reception step that handles the physical signal, and the digital signal is transferred to a transmission / reception step other than the second transmission / reception step. The step includes a rule indicating the correspondence between the time slot and the identifier of the branch or transmission / reception step to be received. A fraud prevention method of equity. As a result, even if an illegal frame is transmitted on a branch that does not match the routing rule, the transfer of the illegal frame is prevented by the secure star coupler, and the security of the vehicle-mounted network is improved.

Hereinafter, a fraud prevention device according to an embodiment will be described with reference to the drawings. Each of the embodiments described here is a specific example of the present disclosure. Therefore, the numerical values, the components, the arrangement and connection of the components, the steps (processes), the order of the steps, and the like shown in the following embodiments are merely examples and do not limit the present disclosure. Among the components in the following embodiments, components not described in the independent claims are components that can be arbitrarily added. In addition, each drawing is a schematic diagram, and is not necessarily strictly illustrated.

(Embodiment 1)
1. System Configuration Here, as an embodiment of the present disclosure, monitoring the in-vehicle network of the star topology, each frame, based on the information indicating the branch of the transmission source of each frame, detects the transmission of an unauthorized frame, Alternatively, the secure star coupler 300 and the fraud detection ECU 310 to be prevented will be described with reference to the drawings.

1.1 Overall Configuration of In-Vehicle Network System 10 FIG. 1 is a diagram illustrating the overall configuration of the in-vehicle network system 10 according to the present disclosure. The in-vehicle network system 10 includes the

FlexRay buses

100a, 100b, 100c, and 100d, and the

ECUs

200a, 200b, 200c, and 200d connected to the buses. And a secure star coupler 300 for connecting each FlexRay bus, and a fraud detection ECU 310 connected to the secure star coupler 300 via the communication line 110. The ECUs 200a to 200d realize control of the vehicle by transmitting and receiving frames via the FlexRay bus. The fraud detection ECU 310 detects transmission of a fraudulent frame by observing the FlexRay bus through the secure star coupler 300. In the

FlexRay buses

100a, 100b, 100c, and 100d, the star coupler shapes the signals so that the same signal flows through any of the buses, and the ECUs are synchronized through the FlexRay bus. Here, each bus is called a branch.

1.2 FlexRay cycle FIG. 2 is a diagram illustrating a cycle of FlexRay communication according to the present disclosure. FlexRay communication is performed in units called a cycle, and each node synchronously holds the number of cycle repetitions (cycle counter). The cycle counter takes a value of 0 to 63. The next cycle in which the cycle counter is 63 resets the cycle counter to zero.

Each cycle is composed of four segments: a static segment (Static segment), a dynamic segment (Dynamic segment), a symbol window (Symbol window), and a network idle time (NIT). Since the time of each segment is common to the entire FlexRay network (cluster) according to parameters designed in advance, the time of one cycle is also common to the cluster.

The static segment is composed of multiple slots. The number of slots and the time of each slot are common in the cluster. In the FlexRay frame, one frame is transmitted in one slot, and the slot number becomes a frame identifier (Frame （ID). Each ECU is designed to transmit a frame at a predetermined timing (slot number). A frame transmitted in a static segment is called a static frame. The static frame has a common payload length within the cluster.

The dynamic segment is composed of slots called mini slots. Similarly, mini-slots have slot numbers, and each ECU is designed to transmit at a predetermined timing (slot number), but unlike the static segment, it is necessary to transmit a frame. There is no. Frames transmitted within the dynamic segment are called dynamic frames. The dynamic frame can take any value from 0 to 254 as the payload length.

The symbol window is a time zone for transmitting and receiving signals called symbols.

The network idle time is a time period during which communication is not performed, and is always provided at the end of a cycle. Each ECU performs a time synchronization process and the like.

1.3 Frame Format FIG. 3 is a diagram illustrating a frame format of the FlexRay protocol according to the present disclosure. Both the static frame and the dynamic frame have a common format. The frame is composed of three segments: a Header Segment, a Payload Segment, and a Trailer Segment.

{Header} Segment starts with Reserved @ bit, and includes Payload @ preamble @ indicator, Null @ frame @ indicator, Sync @ frame @ indicator, and Startup @ frame @ indicator each for indicating a frame type. Further, it is composed of an 11-bit Frame @ ID, a 7-bit Payload @ length, an 11-bit Header @ CRC, and a 6-bit Cycle @ count. The Frame @ ID is also called a slot ID, and is used to identify the transmission timing of a frame and the contents of the frame. Payload @ length can take a maximum value of 127. Payload @ Segment stores the number of bytes obtained by multiplying the value of Payload @ length by two. Header @ CRC is a checksum calculated from a value including Sync @ frame @ indicator to Payload @ length. Cycle @ count stores the current number of cycles.

{Payload} Segment contains data representing the contents of the frame. The number of bytes that is twice the value of Payload @ length is stored, and a maximum of 254 bytes is stored.

{Trailer} Segment stores a CRC calculated from a value including all frames.

1.4 Configuration of ECU 200a FIG. 4 is a configuration of the ECU 200a. Note that the ECU 200b, the ECU 200c, and the ECU 200d are the same components, and thus the description is omitted.

The ECU 200a includes a frame transmission / reception unit 201, a frame interpretation unit 202, an external device control unit 203, a frame generation unit 204, and a communication setting parameter holding unit 205.

The frame transmission / reception unit 201 acquires frame information by decoding a physical signal received from the bus 100a into a digital signal. The frame transmitting / receiving unit can synchronize the time with the other ECUs by referring to the communication setting parameters held in the communication setting parameter holding unit 205, and can correctly receive the frame. Further, the frame transmission / reception unit 201 converts the frame into a physical signal at a predetermined timing in accordance with the transmission frame request notified from the frame generation unit 204, and transmits the physical signal to the bus 100a.

The frame interpreting unit 202 interprets the payload included in the received frame notified from the frame transmitting / receiving unit 201, and notifies the external device control unit to control the handle 210 connected to the ECU 200a according to the content of the payload. I do. For example, the traveling state is determined based on the vehicle speed information notified from another ECU, and the steering assist is controlled in accordance with the traveling state, and the steering operation is performed based on a steering instruction signal in an automatic parking mode. Realize automatic steering.

The external device control unit 203 controls the handle 210 connected to the ECU 200a. Also, it monitors the state of the handle 210 and notifies the frame generation unit of a frame transmission request for notifying the other ECUs of the state. For example, the angle of the handle 210 is notified.

(4) The frame generation unit 204 generates a frame based on the notified signal, and issues a transmission request to the frame transmission / reception unit 201.

The communication setting parameter holding unit 205 holds common parameters in a cluster for correctly converting a physical signal into a digital signal. FIG. 7 shows an example of communication setting parameters stored in the communication setting parameter storage unit 205, which will be described in detail later.

1.5 Configuration of Secure Star Coupler 300 FIG. 5 is a configuration of the secure star coupler 300. The secure star coupler 300 includes

transceiver units

301a, 301b, 301c, 301d, a routing unit 302, an ECU interface unit 303, a received frame holding unit 304, and a routing table holding unit 305.

(4) The transceiver unit 301a converts a physical signal received from the bus 100a into a digital signal and notifies the digital signal to the routing unit 302. When a digital signal is notified from the routing unit 302, the digital signal is converted into a physical signal and transferred to the bus 100a. The

other transceiver units

301b, 301c, 301d have the same function.

(4) The routing unit 302 transfers the digital signal notified from the transceiver unit 301a to the

transceiver units

301b, 301c, and 301d excluding the transceiver unit 301a. Similarly, when the digital signal is notified from the transceiver unit 301b, the digital signal is notified to the transceiver units except the transceiver unit 301b. The ECU interface unit 303 is also notified of the signal being received and the input branch information indicating from which branch the signal is being received. Further, the correspondence between the slot number and the receiving branch (transceiver unit) can be set from the ECU interface unit based on the routing table. At the timing of the slot number, the signal of the set receiving branch is transferred to another branch. Signals from the receiving branch that are not set are ignored and are not transferred to other branches. At the timing when the correspondence between the slot number and the reception branch is not set, the signal from the branch that received the signal first is transferred to another branch.

When notified of the received signal notified by the routing unit 302 and the input branch information, the ECU interface unit 303 interprets the received signal, converts the signal into a received frame, and sends the received frame information to the received frame holding unit 304. Save with. According to the request of the fraud detection ECU 310, the information of the received frame and the input branch information stored in the received frame holding unit 304 are notified. Further, it interprets and executes instructions such as rewriting the table of the branch to be received in each slot stored in the routing table holding unit 305 and reflecting it on the routing unit 302.

The received frame holding unit 304 holds information on received frames. FIG. 8 shows an example of received frame information stored in the received frame holding unit 304.

The routing table holding unit 305 stores a table indicating a branch to be received in each slot. FIG. 9 shows an example of a table stored in the routing table holding unit 305.

1.6 Configuration Diagram of Fraud Detection ECU 310 FIG. 6 is a configuration diagram of the fraud detection ECU 310. The fraud detection ECU 310 includes a star coupler communication control unit 311, a fraud detection unit 312, a frame generation unit 313, a communication setting parameter storage unit 205, a frame information storage unit 314, a frame rule storage unit 315, a branch abnormality degree storage unit 316, and a reception unit. And a history holding unit 317. The functions having the same functions as those of the ECU 200a are given the same numbers, and the description is omitted.

The star coupler communication control unit 311 is a communication interface with the secure star coupler 300, and sets the secure star coupler 300 based on the communication setting parameters stored in the communication setting parameter holding unit 205. The setting of the secure star coupler 300 can also include routing control information based on a table indicating the relationship between slots and reception branches. Further, it receives information about the frame received by the secure star coupler 300 and notifies the fraud detecting unit 312 of the information. When a frame transmission is requested from the frame generation unit 313, the content of the transmission frame is notified to the secure star coupler 300.

(4) The fraud detecting unit 312 is notified of information about the received frame from the star coupler communication control unit 311 and determines whether the received frame is a normal frame. The determination as to whether the frame is a normal frame is made by referring to the ID and the reception branch table stored in the frame information holding unit 314, and confirming whether the correspondence between the ID of the received frame and the reception branch is correct. If the correspondence between the frame and the reception branch is correct, an invalid frame is transmitted by referring to the rule for each ID stored in the frame rule storage 315 and the reception history stored in the reception history storage 317. To determine If it is determined that an invalid frame has been transmitted, a notification is sent to the frame generation unit 313 to notify other ECUs that the invalid frame is being transmitted, and the transmission of the invalid frame is performed. For the executed branch, the value of the degree of abnormality of each branch stored in the branch abnormality degree holding unit 316 is increased. Further, the fraud detecting unit 312 is stored in the routing table holding unit 305 of the secure star coupler 300 in order to prevent a fraudulent frame from being transferred from a branch that is a source of a fraudulent frame to another branch. , The slot and the input branch, and a notification of the control to the routing unit 302.

The frame information holding unit 314 stores a list of IDs of frames transmitted by each ECU and a branch of a transmission source. FIG. 10 shows an example of the frame information held by the frame information holding unit 314, which will be described later in detail.

The frame rule holding unit 315 stores a rule for the fraud detecting unit 312 to determine whether the frame is fraudulent when the frame is received. FIG. 11 shows an example of a frame rule stored in the frame rule holding unit 315, which will be described in detail later.

The branch abnormality degree holding unit 316 stores the degree of abnormality for each branch based on the number of illegal frames received. FIG. 12 shows an example of the branch abnormality degree stored in the branch abnormality degree holding unit 316, which will be described in detail later.

The reception history holding unit 317 stores information on received frames (payload information, meta information such as the type of frame, the number of received frames, and the like). FIG. 13 shows an example of the reception history stored in the reception history holding unit 317, which will be described later in detail.

1.7 Examples of Communication Setting Parameters FIG. 7 shows an example of communication setting parameters stored in the communication setting parameter holding unit 205. The communication setting parameters indicate that the baud rate indicating the communication speed is 10 Mbps, the slot ID of the static segment is 1 to 50, and the slot ID of the dynamic segment is 51 to 100. I have. It also shows that the payload length of the static slot is 8 (that is, 16 bytes). These values are shared by all the ECUs in the cluster, and the transmission and reception of the FlexRay frame is realized based on these values. The value of the communication setting parameter is merely an example, and another value may be used. Also, the parameters shown here are merely examples, and may include parameters not described in FIG. 7 (for example, the length of each segment, the length of a slot, and the like), or may be described in reverse. Some of the parameters may not be included.

1.8 Example of Received Frame Information FIG. 8 shows an example of a received frame list stored in the received frame holding unit 304 of the secure star coupler 300.

In the figure, information on the latest received frame is stored in order from the top. The information of the received frame includes, for each frame, a branch that received the frame, a reception slot ID, a cycle, a payload length, payload information included in the frame, a flag state of the Preamble indicator, and an error flag indicating whether the frame was correctly received. Have been.

1.9 Example of Routing Table FIG. 9 shows an example of a routing table stored in the routing table holding unit 305 of the secure star coupler 300.

In the figure, a table that defines a specific timing (determined by a combination of a slot ID, a cycle offset, and a cycle reception) and a branch that receives a signal at the timing is held. At the timing when the slot ID is 1, Cycle @ offset is 0, and Cycle @ reception is 1, the input branch is 100c, and the routing unit 302 controls the signal received from the bus 100c to transfer it to another branch. I do. At this time, even if a signal is received from a device other than the bus 100c, the routing unit 302 ignores the signal. Similarly, the input branch at a timing when the slot ID is 3, the cycle @ offset is 0, and the cycle @ reception is 2 is 100a, and the input branch at a timing when the slot ID is 98, the cycle @ offset is 1 and the cycle @ reception is 2 is 100b. It indicates that there is.

1.10 Example of Frame Information FIG. 10 shows an example of frame information stored in the frame information holding unit 314 of the fraud detection ECU 310.

In the figure, a slot ID, a cycle offset, a cycle reception, a frame name, and payload information included in the frame are held. Cycle @ offset and Cycle @ reception are information necessary for extracting a target frame when a method of transmitting and receiving frames having different contents is used even with the same slot ID called cycle multiplexing (cycle multiplexing). . For example, a frame with a slot ID of 99 has four frame names, and different contents of camera information 1, camera information 2, camera information 3, and camera information 4 are notified in each frame. In the camera information 1, Cycle @ offset is 0, and Cycle @ reception is 4. This means that the cycle counter starts from 0 and transmits the frame every four cycles. That is, the frame D in which the camera information 1 is notified is transmitted when the slot ID of the cycle counter is 0, 4, 8, 12, 16, ..., 52, 56, 60 is 99. Which indicates that. Similarly, the frame E including the camera information 2 is transmitted when the cycle ID of the cycle counter is 1, 5, 9,... 53, 57, 61 is 99, and the frame F including the camera information 3 is the cycle counter. Are transmitted when the cycle ID of 2, 6, 10,..., 54, 58, 62 is 99, and the frame G including the camera information 4 has the cycle counter of 3, 7, 11,. Sent when the cycle ID of 55, 59, 63 is 99. The method of transmitting different frames with the same slot ID as described above is called cycle multiplexing. Further, as information of each frame, information of a transmission source ECU and information of a branch to which the transmission source ECU is connected are held.

In the figure, the frame whose slot ID is 1, the cycle @ offset is 0, and the cycle @ reception is 1 (that is, the same frame is transmitted in every cycle) has the frame name A, and the payload of the frame A has the speed , The source ECU is 200c, and the branch is 100c. A slot ID of 2 indicates that no frame is transmitted. A frame having a slot ID of 3, a cycle @ offset of 0, and a cycle @ reception of 2 (that is, transmitted only when the cycle counter is an even number) has a frame name B, and the payload of frame B contains information about the handle angle. This includes that the transmission source ECU is 200a and the branch is 100a. A frame whose slot ID is 98, whose Cycle @ offset is 1, and whose Cycle @ reception is 2 (that is, transmitted only when the cycle counter is an odd number) has a frame name C, and information about the gear state is included in the payload of the frame C. This indicates that the transmission source ECU is 200b and the branch is 100b. A frame with a slot ID of 99, a cycle @ offset of 0, and a cycle @ reception of 4 has a frame name of D, the payload of frame D contains information on camera information 1, the source ECU is 200d, and the branch is 100d. A frame having a slot ID of 99, a cycle @ offset of 1, and a cycle @ reception of 4 has a frame name of E, the payload of the frame E includes information on camera information 2, the transmission source ECU is 200d, and the branch is 100d. A frame having a slot ID of 99, a cycle of $ offset of 2, and a cycle of reception of 4 has a frame name of F, the payload of frame F includes information on camera information 3, the transmission source ECU is 200d, and the branch is 100d. A frame having a slot ID of 99, a cycle of $ offset of 3, and a cycle of $ reception of 4 has a frame name of G, the payload of frame G includes information on camera information 4, the transmission source ECU is 200d, and the branch is 100d. Frames A and B are static frames transmitted in the static segment, and frames C to G are dynamic frames transmitted in the dynamic segment.

1.11 Example of Frame Rule FIG. 11 is a diagram illustrating an example of the frame rule stored in the frame rule holding unit 315 of the fraud detection ECU 310. In the figure, a reception rule is set for each frame name.

For frame A, the payload length is fixed at 8, and as a reception rule, if the difference from the previously received speed is 0.5 km / h or more, it is determined that an invalid frame has been received. Regarding frame B, the payload length is fixed at 8, and as a reception rule, it is determined that an invalid frame has been received when the difference from the previously received handle angle is 30 degrees or more. It should be noted that the fraud detection ECU 310 may determine an invalid frame based not only on whether the received frame conforms to the reception rule but also on whether the payload length is correct.

1.12 Example of Branch Abnormality FIG. 12 shows an example of the branch abnormality stored in the branch abnormality degree holding unit 316 of the fraud detection ECU 310. The branch abnormality degree holding unit 316 stores the abnormality degree of each branch. Based on the result of the fraud detecting unit 312, the degree of abnormality of the branch increases by one each time one invalid frame is received. The figure shows an example in which the abnormality degree of the branch 100a is 0, the abnormality degree of the branch 100b is 0, the abnormality degree of the branch 100c is 0, and the abnormality degree of the branch 100d is 20.

1.13 Example of Reception History FIG. 13 is an example of the reception history stored in the reception history holding unit 317 of the fraud detection ECU 310. The figure shows an example in which the last received value and the vehicle state of each frame are held. In the figure, the previous reception value and the reception time (us) are held for each frame. The previous reception value of the speed included in frame A is 40.5 km / h, indicating that the previous reception time was 12100 us. The previous reception value of the handle angle included in frame B is 5 degrees, indicating that the previous reception time was 8100. The gear state included in the frame C is the drive state, and indicates that the previous reception time was 12400 us. The previous reception value of the camera information 1 included in the frame D indicates detection of the preceding vehicle, and indicates that the previous reception time was 1440 us. The previous reception value of the camera information 2 included in the frame E indicates pedestrian detection, and indicates that the reception time was 5480 us. The previous reception value of the camera information 3 included in the frame F indicates the lane detection state, and indicates that the reception time was 9520 us. The previous reception value of the camera information 4 included in the frame G indicates that the rear camera has not been started, and indicates that the reception time is 13560 us. As for the vehicle state, when the speed of the vehicle in frame A is greater than 0 km / h, the fraud detection unit 312 updates the vehicle state stored in the reception history holding unit 317 as the traveling state. When the speed of the vehicle is 0 km / h, the fraud detection unit 312 updates the vehicle state to a stopped state. Although the reception time is held in the present embodiment, the reception time may not be held. Also, the reception time is held in units of us, but the unit may be any unit. For example, the number of micro ticks calculated from the internal clock used in the FlexRay protocol may be used as a unit, or the number of micro ticks defined by the micro tic may be used as a unit.

1.14 Secure Star Coupler Processing Flowchart FIG. 14 is a flowchart showing the operation of the secure star coupler 300. The secure star coupler 300 determines from which branch the signal has been received (S1001). When receiving the signal, the secure star coupler 300 determines whether a routing table corresponding to the current reception timing exists. (S1002). If there is a routing table corresponding to the current reception timing, the secure star coupler 300 checks whether the correspondence between the reception timing and the branch that has received the signal is appropriate (S1003). If there is no routing table corresponding to the current reception timing, the secure star coupler 300 checks whether a signal is being received from another branch (S1006).

In S1003, if the correspondence between the reception timing and the branch that received the signal is appropriate, the secure star coupler 300 transfers the signal being received to a branch other than the branch being received (S1004). The secure star coupler 300 interprets the frame from the subsequently received signal and stores it in the received frame holding unit (S1005). If the correspondence between the reception timing and the branch that has received the signal is not appropriate, the secure star coupler 300 ends the process.

If it is determined in step S1006 that a signal is not already being received from a branch other than the branch that is currently receiving a signal, the secure star coupler 300 executes the processing from step S1004. If a signal is being received from another branch, the secure star coupler 300 ends the process.

If it is determined in step S1001 that the signal has not been received, the secure star coupler 300 determines whether a notification has been received from the ECU (S1007). If the notification has not been received, the secure star coupler 300 executes S1001. When receiving the notification, the secure star coupler 300 determines whether the notification content is a frame transmission request (S1008). If the notification content is a frame transmission request, the secure star coupler 300 transmits the frame to all branches (S1009), and ends the processing. If the notification content is not a request for transmitting a frame, the secure star coupler 300 determines that the notification content is a request for reflecting the update / setting of the routing table, updates the routing table, reflects the setting (S1010), and executes the process. finish.

1.15 Operation of Fraud Detection ECU 310 FIG. 15 is a flowchart showing the operation of the fraud detection ECU 310. The fraud detection ECU 310 receives the frame (S1101). The fraud detection ECU 310 checks whether the reception branch of the received frame matches the slot ID of the reception frame described in the frame information and the reception branch (S1102). If it matches the reception branch, the fraud detection ECU 310 checks whether it matches the frame rule corresponding to the reception frame (S1103). If the frame rule is satisfied, the fraud detection ECU 310 ends the process.

In steps S1102 and S1103, if the received frame and the received branch do not match, or if the received frame does not match the frame rule, the fraud detection ECU 310 increases the degree of abnormality of the receiving branch by one (S1104). Thereafter, the fraud detection ECU 310 determines whether the abnormality level of the receiving branch is equal to or greater than a predetermined threshold (S1105). If the predetermined threshold value is abnormal, the fraud detection ECU 310 updates the routing table of the secure star coupler 300 (S1106) to suppress illegal frame transmission by the branch, and ends the processing.

(Embodiment 2)
2. System Configuration Here, as an embodiment of the present disclosure, an in-vehicle network of a star topology is monitored, and transmission of an unauthorized frame is performed using information indicating each frame, a branch indicating a transmission source branch of each frame, and a blacklist. The secure star coupler 1300 and the fraud detection ECU 1310 for preventing the occurrence of a fraud will be described with reference to the drawings. Components having functions similar to those of the first embodiment are given the same numbers, and descriptions thereof are omitted.

2.1 Configuration of Secure Star Coupler 1300 FIG. 16 is a configuration of the secure star coupler 1300. The secure star coupler 1300 includes

transceiver units

301a, 301b, 301c, and 301d, a routing unit 1302, an ECU interface unit 1303, a received frame holding unit 304, a routing table holding unit 305, a black list holding unit 1306, a branch abnormality degree holding unit 316, and a running. And a state holding unit 1307.

The routing unit 1302 transfers the digital signal notified from the transceiver unit 301a to the

transceiver units

301b, 301c, 301d excluding the transceiver unit 301a. Similarly, when the digital signal is notified from the transceiver unit 301b, the digital signal is notified to the transceiver units except the transceiver unit 301b. Also, it notifies the ECU interface unit 1303 of the signal being received and the input branch information indicating from which branch the signal is being received. Further, the correspondence between the slot number and the receiving branch (transceiver unit) can be set based on the routing table stored in the routing table holding unit 305. At the timing of the slot number, the signal of the set receiving branch is converted to another signal. Transfer to branch. Signals from the receiving branch that are not set are ignored and are not transferred to other branches. At the timing when the correspondence between the slot number and the reception branch is not set, the signal from the branch that received the signal first is transferred to another branch. In addition, even during the transfer of the signal, the signal being transferred is decoded, and it is determined whether or not the signal matches the blacklist held in the blacklist holding unit 1306. If the signal being transferred matches the blacklist, and the branch abnormality degree stored in the branch abnormality degree holding unit and the running state stored in the running state holding unit are referred to, the validity condition of the blacklist is satisfied. In such a case, the transfer of the signal being transferred to another branch is stopped. This makes it possible to prevent transfer of an illegal signal according to the payload value, even when an illegal ECU exists in a branch that matches the routing table. In addition, it decodes the signal of each branch and performs error detection processing for confirming whether an error in the protocol has occurred in each branch. If there is a branch in which an error has occurred in a slot in which the routing table is valid, the abnormality level of the corresponding branch stored in the branch abnormality degree storage unit 316 is increased. This is performed in order to know from which branch the illegal frame transmission is being attempted. If there is an ECU that attempts to transmit an incorrect frame in the slot in a branch different from the branch in which the legitimate ECU that transmits the frame in the specific slot exists, the secure star coupler 1300 does not match the routing table Since the transmission of the illegal frame from the branch is ignored, it is possible to prevent the transfer of the illegal frame. However, it is not possible to grasp that the illegal frame has occurred in the branch by this alone. The frame transmitted from the legitimate ECU matches the routing table and is forwarded to the other branch.At this time, the frame transmitted from the unauthorized ECU and the forwarded frame collide, and the illegal frame is transmitted. It is detected that only a branch in which an appropriate ECU exists is in an error state.

When notified of the received signal notified by the routing unit 1302 and the input branch information, the ECU interface unit 1303 interprets the received signal, converts the received signal into a received frame, and sends the received frame information to the received frame holding unit 304. Save with. According to the request of the fraud detection ECU 310, the information of the received frame and the input branch information stored in the received frame holding unit 304 are notified. Further, the table of the branch received in each slot stored in the routing table holding unit 305 is rewritten, the blacklist stored in the blacklist holding unit is updated, and the branch held in the branch abnormality degree holding unit 316 is stored. The degree of abnormality is updated, and the running state stored in the running state holding unit 1307 is updated.

The blacklist holding unit 1306 refers to the routing unit 1302 and stores a blacklist for stopping the transfer of a signal being transferred. FIG. 18 shows an example of a blacklist held by the blacklist holding unit 1306, which will be described later in detail.

The driving state holding unit 1307 is used as a condition for validating the blacklist stored in the blacklist holding unit 1306. FIG. 19 shows an example of the traveling state held by the traveling state holding unit 1307. In the drawing, the traveling state indicates that the vehicle is traveling.

2.2 Configuration Diagram of Fraud Detection ECU 1310 FIG. 17 is a configuration diagram of the fraud detection ECU 1310. The fraud detection ECU 1310 includes a star coupler communication control unit 1311, a fraud detection unit 1312, a frame generation unit 313, a communication setting parameter storage unit 205, a frame information storage unit 314, a frame rule storage unit 315, a reception history And a holding unit 317.

The star coupler communication control unit 1311 is a communication interface with the secure star coupler 1300, and sets the secure star coupler 1300 based on the communication setting parameters stored in the communication setting parameter holding unit 205. The settings of the secure star coupler 1300 also include information on a routing table based on a table indicating the relationship between slots and reception branches and a blacklist. Furthermore, the update notification of the traveling state of the vehicle determined based on the received frame and the notification regarding the increase in the degree of branch abnormality are performed. Further, it receives information on the frame received by the secure star coupler 1300 and notifies the fraud detecting unit 1312 of the information. When frame transmission is requested from the frame generation unit 313, the content of the transmission frame is notified to the secure star coupler 1300.

(4) The fraud detecting unit 1312 is notified of information about the received frame from the star coupler communication control unit 1311 and determines whether the received frame is a normal frame. The determination as to whether the frame is a normal frame is made by referring to the ID and the reception branch table stored in the frame information holding unit 314, and confirming whether the correspondence between the ID of the received frame and the reception branch is correct. If the correspondence between the frame and the reception branch is correct, an invalid frame is transmitted by referring to the rule for each ID stored in the frame rule storage 315 and the reception history stored in the reception history storage 317. To determine If it is determined that an invalid frame has been transmitted, a notification is sent to the frame generation unit 313 to notify other ECUs that the invalid frame is being transmitted, and the transmission of the invalid frame is performed. It notifies the star coupler communication control unit 1311 that the executed branch is abnormal. Further, the fraud detecting unit 1312 is stored in the routing table holding unit 305 of the secure star coupler 1300 in order to prevent a fraudulent frame from being transferred from a branch that is a source of a fraudulent frame to another branch. , The slot and the input branch are notified of the rewriting of the table.

2.3 Example of Black List FIG. 18 is an example of a black list stored in the black list holding unit 1306. In the figure, an input branch, a blacklist, and a blacklist operation condition are held for each frame defined by a combination of a slot ID, a cycle offset, and a cycle reception. A frame with a slot ID of 20, a cycle offset of 3, and a cycle reception of 4 has an input branch of 100d, a blacklist of ** 5 *..., And the blacklist operating conditions are that the running state is running and the branch is abnormal. It is shown that the degree is greater than 30. Here, * in the black list means don't care, and indicates that when a payload in which the upper 4 bits of the upper 2 bytes are 5 is received, it matches the black list. Similarly, the slot ID is 10, the cycle offset is 0, the cycle reception is 2, the input branch is 100a, the blacklist is FF 11 **..., And the blacklist operation condition is that it always operates when it matches the blacklist. I have.

2.4 Processing Flowchart of Secure Star Coupler FIG. 20 is a processing flowchart of the secure star coupler 1300 when receiving a frame. The secure star coupler 1300 starts receiving a frame (S2001). The secure star coupler 1300 checks whether a routing table corresponding to the current slot exists (S2002). If a corresponding routing table exists, the secure star coupler 1300 executes S2003. Otherwise, the secure star coupler 1300 executes S2011.

In step S2003, the secure star coupler 1300 checks whether the relationship between the frame currently being received and the receiving branch matches the routing table. If it matches the routing table, the secure star coupler 1300 starts routing for transferring the received signal to another branch (S2004). Otherwise, the secure star coupler 1300 increments the abnormality level of the reception branch (S2008) and ends the processing.

The secure star coupler 1300 decodes the signal being transferred during routing (after S2004), and checks whether the signal matches the blacklist held by itself (S2005). If it matches the blacklist, the secure star coupler 1300 stops the routing (S2009) and ends the processing. If they do not match the blacklist, the secure star coupler 1300 transfers all signals (S2006).

(4) After S2006, the secure star coupler 1300 checks the error occurrence status of each branch (S2007), and if there is no error in all branches, ends the processing assuming that the transfer is normally completed. If there is an erroneous branch, the secure star coupler 1300 determines that there is a possibility that an illegal frame has been transmitted, and increments the abnormality degree of the erroneous branch (S2010). finish.

(4) In S2011, the secure star coupler 1300 checks whether a signal received from another branch is currently being transferred. If routing is not being performed, S2004 is executed. If routing is being performed, secure star coupler 1300 ignores the received signal and ends the process.

2.5 Processing Flowchart of Fraud Detection ECU at the Time of Receiving Frame FIG.

Upon receiving the notification of frame reception from the secure star coupler 1300, the fraud detection ECU 1310 acquires payload information on the received frame and information on the reception branch (S2101), and stores the frame information stored in the frame information holding unit 314. , It is determined whether the correspondence between the received frame and the received branch is appropriate (S2102). If the response is appropriate, the fraud detection ECU 1310 executes S2103. If the response is not appropriate, the fraud detection ECU 1310 notifies the secure star coupler 1300 to increase the degree of abnormality of the corresponding branch (S2106), and ends the process.

In S2103, the fraud detection ECU 1310 refers to the frame rule stored in the frame rule holding unit 315, and checks whether the received frame conforms to the frame rule. If the frame rule is satisfied, the fraud detection ECU 1310 determines that the legitimate frame has been received, updates the reception history stored in the reception history holding unit 317 (S2104), and notifies the secure star coupler 1300 of the running state update notification. (S2105), and the process ends. If the frame rule is not satisfied, it is determined that an invalid frame has been received, and the fraud detection ECU 1310 notifies the secure star coupler 1300 to increase the degree of abnormality of the receiving branch (S2106), and ends the processing.

3. Other Modifications Although the present disclosure has been described based on the above embodiments, the present disclosure is, of course, not limited to the above embodiments. The following cases are also included in the present disclosure.

(1) In the above embodiment, an example in a star network topology is shown, but the network topology is not limited. For example, a network topology such as a bus-type hybrid or a star-type hybrid can be adopted.

(2) In the above embodiment, the secure star coupler and the fraud detection ECU are described separately. However, the secure star coupler may be built in the fraud detection ECU. This is effective in reducing the number of parts.

(3) In the above embodiment, the secure star coupler communicates with the fraud detecting ECU, but the fraud detecting ECU is not an essential component. For example, the contents of the routing table storage unit and the communication setting parameter storage unit may be embedded in advance to realize only the minimum necessary functions. As a result, the number of ECUs can be reduced, which leads to cost reduction and is effective.

(4) In the above embodiment, the process is terminated after detecting an invalid frame. However, the response when an invalid frame is detected is not limited to this. For example, regarding the invalid frame, the branch information, the header information, the payload value, the reception time, etc., which transmitted the invalid frame may be stored as a log, or the other ECU may be notified of the invalid frame. Alternatively, an external server may be notified that the vehicle has been fraudulent, or the driver may be notified that the vehicle's in-vehicle network has been fraudulent.

(5) In the above embodiment, the frame information and the frame rule are stored in plain text, but may be stored after being encrypted.

(6) In the above embodiment, the abnormality level is held for each branch, but the abnormality level may be held for each frame. As a result, it is possible to cut off only the frame having a high degree of abnormality, and it is possible to suppress the influence on the vehicle, which is effective.

(7) In the above embodiment, the number of reception rules stored in the frame rule holding unit is one for each frame, but there may be one or more reception rules. In addition, a reception rule may not exist. This makes it possible to check according to the importance of the frame, which is effective in improving the security of the vehicle-mounted network.

(8) In the above embodiment, the reception rule stored in the frame rule holding unit is not set for a dynamic frame, but a frame rule may be set. For example, a rule regarding the amount of change from the previous value may be set.

(9) In the above embodiment, the secure star coupler has received the frame transmission request from the fraud detection ECU and has been able to transmit the frame to another branch. However, the transmission may not be possible. Thereby, the function of the secure star coupler can be reduced, which leads to cost reduction and is effective.

(10) In the above embodiment, the frame name is held in the frame information stored in the frame information holding unit. However, the frame name may not be held.

(11) In the above embodiment, one piece of payload information is held for one frame with respect to the frame information stored in the frame information holding unit. However, one or more pieces of payload information may be held. There may be no payload information. The payload information may include information indicating a field on the payload of each signal such as speed (field position, length, unit, etc.).

(12) In the above embodiment, only one signal of the previous reception value of the reception history is stored for each frame name. However, a plurality of signals may be stored, or the payload value may be stored as it is. .

(13) In the above embodiment, the vehicle history included in the reception history is only the two states of running or stopped, but the vehicle state is not limited to these two states. For example, an ignition-on state, an accessory-on state, a low-speed running state, a high-speed running state, a steering wheel steering state, a gear state, or a state in which these are combined can be taken.

(14) In the above-described second embodiment, an example in which the blacklist is held in advance has been described, but the blacklist may be dynamically updated. For example, when the fraud detection ECU holds a payload value detected as a fraudulent frame and detects a predetermined number or more fraudulent frames in a frame of the same ID, cycle reception, and cycle offset, the payload value of the fraudulent frame is changed. A matching field may be updated as a blacklist. This makes it possible to prevent the routing of an unauthorized frame that is not registered in the blacklist in advance, which leads to an improvement in security and is effective.

(15) In the second embodiment, the error detection mechanism is provided in the routing unit. However, the error detection mechanism may not be provided in the routing unit (secure star coupler). For example, the error detection ECU connected to the secure star coupler may receive an arbitrary two-branch signal so that the error detection may be performed by the decoder unit included in the error detection ECU.

(16) In the above-described second embodiment, the transfer of the signal matching the blacklist is stopped, but processing other than stopping the transfer of the signal may be performed. For example, the CRC value included in the frame may be rewritten. Any measures can be taken as long as the signals being transferred are not recognized and processed by other ECUs as valid frames.

(17) In the above-described second embodiment, the transfer of signals that match the blacklist is stopped. However, the transfer of signals that do not match the whitelist may be stopped.

(18) In the above-described second embodiment, the vehicle running state and the degree of branch abnormality are used for the activation condition of the blacklist, but may be used for the activation condition of the routing rule. As a result, frame transmission from the branch where the unauthorized ECU exists can be invalidated, which is effective.

(19) In the above-described second embodiment, the traveling state of the vehicle is held in the traveling state holding unit, but the traveling state may not be in the traveling state. For example, a flag signal notified from the ECU may be used. Thereby, the blacklist can be validated according to the flag signal, and more flexible response is possible.

(20) In the above embodiment, the FlexRay protocol was used as the in-vehicle network, but the present invention is not limited to this. For example, CAN, CAN-FD (CAN with Flexible Data Rate), Ethernet, LIN (Local Interconnect Network), MOST (Media Oriented Systems Transport), or the like may be used. Alternatively, a network in which these networks are combined as a sub-network may be used. This is particularly effective for a network employing a time trigger method.

(21) Each device in the above embodiment is, specifically, a computer system including a microprocessor, a ROM, a RAM, a hard disk unit, a display unit, a keyboard, a mouse, and the like. A computer program is recorded in the RAM or the hard disk unit. Each device achieves its function by the microprocessor operating according to the computer program. Here, the computer program is configured by combining a plurality of instruction codes indicating instructions to the computer in order to achieve a predetermined function.

(22) Each or all of the constituent elements of each device in the above embodiment may be configured by one system LSI (Large Scale Integration). The system LSI is an ultra-multifunctional LSI manufactured by integrating a plurality of components on one chip, and is specifically a computer system including a microprocessor, a ROM, a RAM, and the like. . The RAM stores a computer program. When the microprocessor operates according to the computer program, the system LSI achieves its function.

Each part of the constituent elements constituting each device described above may be individually formed into one chip, or may be formed into one chip so as to include a part or all.

とした Although the term LSI is used here, it may also be called IC, LSI, super LSI, or ultra LSI depending on the degree of integration. Further, the method of circuit integration is not limited to LSI, and may be realized by a dedicated circuit or a general-purpose processor. After manufacturing the LSI, a programmable FPGA (Field Programmable Gate Array) or a reconfigurable processor capable of reconfiguring connection and setting of circuit cells inside the LSI may be used.

(4) Further, if an integrated circuit technology that replaces the LSI appears due to the advancement of the semiconductor technology or another derivative technology, the functional blocks may be naturally integrated using the technology. Application of biotechnology, etc. is possible.

(23) A part or all of the constituent elements of each device described above may be constituted by an IC card detachable to each device or a single module. The IC card or the module is a computer system including a microprocessor, a ROM, a RAM, and the like. The IC card or the module may include the above-mentioned super multifunctional LSI. The IC card or the module achieves its function by the microprocessor operating according to the computer program. The IC card or the module may have tamper resistance.

(24) The present disclosure may be the methods described above. Further, these methods may be a computer program that is realized by a computer, or may be a digital signal composed of a computer program.

The present disclosure also relates to a computer-readable recording medium capable of reading a computer program or a digital signal, for example, a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) ) Disc), and may be recorded in a semiconductor memory or the like. Further, it may be a digital signal recorded on these recording media.

In addition, the present disclosure may transmit a computer program or a digital signal via an electric communication line, a wireless or wired communication line, a network represented by the Internet, a data broadcast, or the like.

Also, the present disclosure may be a computer system including a microprocessor and a memory, wherein the memory records the computer program, and the microprocessor may operate according to the computer program.

Alternatively, the program or digital signal may be recorded on a recording medium and transferred, or the program or digital signal may be transferred via a network or the like, so as to be implemented by another independent computer system.

(25) The above embodiment and the above modified examples may be combined.

(4) The present disclosure provides a secure in-vehicle network system by observing a frame flowing in the in-vehicle network, grasping a transmission position of an illegal frame, and taking measures. As a result, a secure state can be maintained for the entire in-vehicle network system.

10 In-

vehicle network system

100a, 100b, 100c,

100d Bus

200a, 200b, 200c, 200d ECU
Reference Signs List 201 frame transmission / reception unit 202 frame interpretation unit 203 external device control unit 204 frame generation unit 205 communication setting parameter holding unit 210 handle 220 gear 230 brake 240

camera

300, 1300

secure star coupler

301a, 301b, 301c,

301d transceiver unit

302, 1302

Routing unit

303, 1303 ECU interface unit 304 Received frame holding unit 305 Routing

table holding unit

310, 1310 Fraud detection ECU
311, 1311 Star coupler

communication control unit

312, 1312 Fraud detection unit 313 Frame generation unit 314 Frame information storage unit 315 Frame rule storage unit 316 Branch abnormality degree storage unit 317 Reception history storage unit 1306 Black list storage unit 1307 Running state storage unit

Claims

A secure star coupler in a vehicle-mounted network that is a time-trigger-based communication system based on a time slot, wherein the vehicle-mounted network includes a plurality of branches including one or more electronic control units and one vehicle-mounted network bus. Connected through a star coupler, the electronic control unit transmits and receives frames within a predetermined time slot,
The secure star coupler includes a plurality of transceiver units corresponding to the number of branches, a routing unit, and a routing rule holding unit,
The transceiver unit is connected to one of the branches, converts a physical signal of a bus of the connected branch into a digital signal, and notifies the routing unit of the received signal, and a digital signal received from the routing unit. To a physical signal, and transmits to the bus, a transmission unit,
The routing unit transfers the digital signal received from the first transceiver unit connected to the first branch to a plurality of transceiver units other than the first transceiver unit, unless a non-transfer condition is met. ,
When the non-transfer condition does not satisfy a predetermined condition described in the routing rule holding unit, and when a digital signal is received from a second transceiver unit other than the first transceiver unit already connected to the first branch, And transmitting digital signals to transceiver units other than the second transceiver unit.
The routing rule holding unit holds a rule indicating a correspondence between a time slot and an identifier of a branch or a transceiver unit to be received,
A secure star coupler, characterized in that:
The secure star coupler further includes a branch abnormality degree holding unit,
The branch abnormality degree holding unit holds an abnormality degree for each branch,
The degree of abnormality increases the degree of abnormality of the branch corresponding to the third transceiver unit when a digital signal received from the third transceiver unit at a timing that does not match a rule is stored in the routing rule storage unit. Let
The non-transfer condition, in addition, corresponds to the transceiver unit that has received the digital signal, the case where the corresponding abnormality degree held in the branch abnormality degree is a predetermined value or more,
The secure star coupler according to claim 1, wherein:
The secure star coupler further decodes the digital signal of each branch, and includes an error detection unit for detecting whether or not an error has occurred in a frame in a frame, for each branch,
In addition, the abnormality level corresponds to the first error detection unit when the first error detection unit detects an error in a time slot in which the rule is valid, which is described in the routing rule holding unit. Increase the anomaly of the branch,
The secure star coupler according to claim 2, wherein:
The secure star coupler further includes a communication control unit for performing communication with the electronic control device,
The routing unit further decodes a digital signal received from the first transceiver unit, and decodes the digital signal as a frame, the frame, and an identifier indicating the first transceiver unit that is a transfer source. A reception frame holding unit that holds the information together,
The communication control unit, the information of the received frame holding unit, notifies an electronic control unit,
The secure star coupler according to any one of claims 1 to 3, characterized in that:
The secure star coupler further includes a blacklist holding unit that holds a blacklist,
The blacklist holding unit holds a condition of a value of a payload included in a frame in a predetermined time slot, prohibiting transfer,
The routing unit further includes a blacklist matching unit that decodes the digital signal being transferred and is included in the blacklist holding unit, and performs matching with a corresponding rule.
The blacklist matching unit, when determining that the digital signal being transferred matches the blacklist, stops the transfer of subsequent digital signals.
The secure star coupler according to claim 4, wherein:
The secure star coupler further includes a traveling state holding unit,
The communication control unit further includes a traveling state receiving unit that receives a traveling state from the electronic control device and updates a value of the traveling state holding unit,
The blacklist collating unit, only when the traveling state of the traveling state holding unit satisfies a predetermined condition, stops the subsequent transmission of the signal being transmitted that matches the blacklist,
The secure star coupler according to claim 5, wherein:
A method for preventing fraud in an in-vehicle network that is a time-triggered communication system based on a time slot, wherein the in-vehicle network includes a plurality of branches each including one or more electronic control units and one in-vehicle network bus. Connected through a star coupler, the electronic control unit transmits and receives frames within a predetermined time slot,
The fraud prevention method includes a plurality of transmission / reception steps corresponding to the number of branches, a routing step, and a routing rule holding step,
The transmitting / receiving step converts a physical signal of a bus of any branch into a digital signal and notifies the routing step of the physical signal, and converts the digital signal received from the routing step into a physical signal and transmits the physical signal to the bus. And a transmitting step.
The routing step transfers the digital signal received from the first transmission / reception step that handles the physical signal of the first branch to a plurality of transmission / reception steps other than the first transmission / reception step, unless a non-transfer condition is met. And
The non-transfer condition includes a case where the predetermined condition described in the routing rule holding step is not met, and a case where the digital signal is transmitted from the second transmission / reception step other than the first transmission / reception step which already handles the physical signal of the first branch. Receiving and transferring a digital signal to a transmitting / receiving step other than the second transmitting / receiving step,
The routing rule holding step holds a rule indicating a correspondence between a time slot and a branch to be received or an identifier of a transmission / reception step,
A fraud prevention method characterized in that: